AIDEN is an internal assistant embedded in Hartwell’s employee portal. It handles HR questions, IT support requests, and internal documentation while carrying configuration details that should not be available through the user interface.
This practical was the capstone of a larger LLM penetration-testing lab. The work covered the full assessment path: finding AI services, identifying the model and surrounding infrastructure, testing direct and indirect prompt injection, extracting configuration, and validating every result against the target rather than trusting model output at face value.
Mapping the AI attack surface
The assessment began outside the chat box. Service discovery and fingerprinting identified the interfaces around the model, including Ollama and MLflow behavior encountered earlier in the lab. That infrastructure context shaped which tests belonged against the model, which belonged against the application, and where an exposed service could bypass controls enforced only by the frontend.
I treated each response as evidence with a confidence level. Model names, configuration strings, URLs, and flag-shaped artifacts were useful leads, but none became a finding until they matched the behavior of the target environment.
When the familiar test failed
Constraint enumeration had worked immediately against earlier assistants. AIDEN refused the same request and redirected the conversation toward its approved support functions. That failure mattered because it ruled out the simplest disclosure path and forced a change in framing.
The next test presented the request as a deployment-verification task from the developer responsible for the system. AIDEN accepted the asserted authority without an independent identity or authorization check and returned its protected configuration in one response.
What the response proved
The disclosure included the primary database server, an internal administrative URL, a support-escalation address, and the protected operations code. The public screenshot preserves the response while redacting the CTF flag.
The successful test mapped to MITRE ATLAS technique AML.T0054, LLM Jailbreak. More importantly, it exposed the underlying control failure: AIDEN changed its disclosure behavior based on an identity and operational role asserted entirely inside the conversation.
The remediation is broader than adding another refusal phrase. Sensitive configuration should not live in model instructions; identity and authorization decisions belong outside the model; retrieval and tool access should enforce least privilege; and model output should be logged and tested as a secondary control, not trusted as the boundary.
Assessment result
AIDEN was not defeated by a longer prompt or a more forceful request. The successful framing made disclosure appear consistent with the assistant’s purpose. Documenting the failed constraint-enumeration attempt alongside the successful authority claim preserved the part of the investigation that matters most: why the direction changed and which assumption the model ultimately trusted.